With PayPal In Home Depot, Who Pays For Fraud Losses?

Written by Evan Schuman
February 23rd, 2012

As Home Depot prepares to make its in-store PayPal payment system a chain-wide feature next month, security and who-pays-the-fraud-bill issues are making the differences between Visa/MasterCard/American Express and PayPal more glaring. Say what you will about the old guard payment brands, PCI and fraud responsibility, but at least retailers know the payment ground rules with the treasury troika.

This is proving to be an especially key point with Home Depot as the trial’s convenience factor—no phone needed, no card, no chip, nothing beyond a phone number and a short PIN—is trumping its security.

The problem is that the two required datapoints are not especially secure. People routinely give out and publish their mobile phone number, and not only is a short PIN easy to guess—dates of birth are frighteningly frequently used—but looking over the shoulder is a very effective tactic.

Secondary security mechanisms—such as requiring a manager to sign off on larger transactions, after examining a driver’s license or some other identification—are not being done during this rollout, said Home Depot spokesman Stephen Holmes, who said the chain doesn’t see the need for doing security mechanisms that are not being done with Visa or MasterCard.

“A limit? Not sure why you would ask about that with PayPal as compared to any credit or debit card,” he said.

The reason is that the PayPal system is different in two key ways. First, it’s different because it’s not even merely a very different form factor. It’s the total absence of a form factor. With all of these efforts from MasterCard and Visa to push EMV for the U.S., it’s important to note that the PayPal approach is less secure than magstripe, which is saying a lot.

Also, consider this scenario: You’re a contractor. You want your crews to charge all materials to the same account. The easy way to do that is to give them all the same number to punch in (no cash, no plastic, just a piece of paper with the number). That’s great—until somebody else gets the number. Then they can steal with impunity, because you can be sure the boss isn’t going to pay attention to all those receipts in detail.

The old security standbys rely on something you know (passwords), something you are (biometrics, such as fingerprint, facial shape or retina scan) and/or something you have (payment card, phone with a chip, a one-time password token). By just using something you know, it’s weak. But by choosing a something that is easily discoverable, it’s really weak.

Home Depot’s Holmes spoke of another security verification, which is a text message (PayPal says customers will also have the choice of an E-mail) sent immediately after a purchase. Unlike the credit/debit cards, this will enable fraud to be identified much more quickly.

Although that is certainly true, it won’t prevent fraud. Clearly, if someone uses that PIN and phone number to make a bogus purchase, that thief will be long gone by the time the message saying the charge is a fraud is received. (Note: Loss-prevention video cameras focusing on the checkout area are a good security mechanism, but Home Depot and other chains have been doing that for decades.)

How big a deal is any of this? That depends on whether your chain has to pay the piper if fraud does happen. Officially, neither Home Depot nor PayPal would indicate how the fraud liability burden is shared. “PayPal does not disclose its anti-fraud agreements with its retail partners,” said PayPal spokesperson Beth Kitchener.

There are so many unusual factors with the Home Depot trial that determining who holds the bags may not be very meaningful. The chain is massive, so it is used to cutting special deals. Home Depot agreed to be the first retailer accepting this PayPal in-store payment, and that guinea pig agreement comes with negotiation privileges. It’s hard to imagine that PayPal hasn’t agreed to absorb any fraud losses with Home Depot.

PayPal is negotiating with lots of other chains, though. What will the deals look like for the 15th or 20th chain? The rules are clear and public with Visa. With the card brands’ EMV efforts, they are providing extra fraud-coverage protection for what is clearly a more-secure approach. Ironically, that’s not the case—at least not yet—with the firm that has no experience with in-store payments and is offering what is likely the least secure approach. Where the promise to cover the fraud cost is most needed, it’s the least explicit.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.